Summary

Certain Ruijie wireless products contain a command execution vulnerability. An attacker who has already obtained web login access to the device can inject operating system commands through the CLI for execution.
Ruijie vulnerability ID: PSIRT-2026-092802
External vulnerability IDs: JVN#28897261 、CVE-2026-113347

Software Versions and Fixes

Affected Product
Affected Version
Repair Version
RG-MA2610-AC

MA_1.1(1)B5P4, Release(09180912)

MA_1.1(1)B5P6, Release(09221815)

MA_1.1(1)B5P6, Release(10130317)

MA_1.1(1)B5P6, Release(09200420)

MA_1.1(1)B5P6, Release(09202514)

MA_1.3(1)B5P9, Release(10200118)

MA_1.3(1)B8P1, Release(11142512)

MA_1.3(1)B8P1, Release(12140614)
MA_1.3(1)B8P1_MA2610_[xiyuan-jp-ma2610]_13221212.bin
RG-MA2610-PE

MA_1.1(1)B5P4, Release(09180912)

MA_1.1(1)B5P6, Release(09221815)

MA_1.1(1)B5P6, Release(10130317)

MA_1.1(1)B5P6, Release(09200420)

MA_1.1(1)B5P6, Release(09202514)

MA_1.3(1)B5P9, Release(10200118)

MA_1.3(1)B8P1, Release(11142512)

MA_1.3(1)B8P1, Release(12140614)
MA_1.3(1)B8P1_MA2610_[xiyuan-jp-ma2610]_13221212.bin
RG-MA2810

MA_1.1(1)B5P6, Release(10141712)

MA_1.1(1)B5P6, Release(09200420)

MA_1.1(1)B5P6, Release(09202613)

MA_1.3(1)B5P9, Release(10200118)

MA_1.3(1)B8P1, Release(11142512)

MA_1.3(1)B8P1, Release(12140614)

MA_1.3(1)B12P1, Release(12200718)

MA_1.3(1)B12P1, Release(12201315)

MA_1.3(1)B12P1, Release(12211918)

MA_1.3(1)B12P1, Release(12240317)

MA_1.3(1)B12P1, Release(13151115)

MA_1.3(1)B12P1, Release(13201411)
MA_1.3(1)B12P1_MA2810_[xiyuan-jp-ma2810]_13221212.bin
RG-AP180-AC V4

MA_1.3(1)B10, Release(11172318)

MA_1.3(1)B10, Release(11180414)

MA_1.3(1)B10, Release(11181517)

MA_1.3(1)B10, Release(11211121)

MA_1.3(1)B10P1, Release(11211320)

MA_1.3(1)B10P1, Release(12130915)

MA_1.3(1)B10P1, Release(12161019)

MA_1.3(1)B10P2, Release(13171910)
MA_1.3(1)B10P2_AP180_[xiyuan-jp-ap180v4]_13221212.bin
RG-AP180-PE V4

MA_1.3(1)B10, Release(11172318)

MA_1.3(1)B10, Release(11180414)

MA_1.3(1)B10, Release(11181517)

MA_1.3(1)B10, Release(11211121)

MA_1.3(1)B10P1, Release(11211320)

MA_1.3(1)B10P1, Release(12130915)

MA_1.3(1)B10P1, Release(12161019)

MA_1.3(1)B10P2, Release(13171910)
MA_1.3(1)B10P2_AP180_[xiyuan-jp-ap180v4]_13221212.bin
RG-MA3511-AC

MA_1.3(1)B11, Release(11232315)

MA_1.3(1)B11, Release(11240617)

MA_1.3(1)B11, Release(12131622)
MA_1.3(1)B11_MA3511_[shizhu-ma3511-main]_13221212.bin
RG-MA3511-PE

MA_1.3(1)B11, Release(11232315)

MA_1.3(1)B11, Release(11240617)

MA_1.3(1)B11, Release(12131622)
MA_1.3(1)B11_MA3511_[shizhu-ma3511-main]_13221212.bin
Obtaining Fixed Software：
  1. The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.
  2. Download it from the Ruijie Networks websites：https://www.ruijie.co.jp/products.
  3. Contact local after-sales personnel to obtain it.

Vulnerability Scoring

Vulnerabilities are scored based on the CVSS v3.1 scoring system. For details, please refer to: https://www.first.org/cvss/v3.1/specification-document .
Base Score: 7.2
CVSS v3.1 Vector:  AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporary Fix

  • Users are advised to strengthen web login password complexity: passwords should contain at least three of the following four character types — uppercase letters, lowercase letters, digits, and special characters — and be at least 12 characters long.
  • Configure a management access control whitelist so that only specific IP addresses can log in to the device's web management system.

Source

This vulnerability is reported by an external researcher.

Revision History

Date
Revision History
2026-11-12
Initial Release

Contact Us

Ruijie Networks adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deals with product security issues through our response mechanism.
To enjoy Ruijie Networks PSIRT services and obtain Ruijie Networks product vulnerability information, please visit https://www.ruijienetworks.com/support/securityBulletins .
To report a security vulnerability in Ruijie Networks products and solutions, please send it to  PSIRT@ruijie.com.cn . For details, please visit https://www.ruijienetworks.com/support/securityBulletins/vulnerability_reporting .
You can contact us through the following channels:
  1. Support:https://www.ruijienetworks.com/support
  2. Community:https://community.ruijienetworks.com/portal.php
  3. Live Chat:https://www.ruijienetworks.com/rita